ID. Date of interview 
date 99/02/20 


ID. Time interview started 
start 46:35:03 


ID.end Completion date of interview 
Date 9/02/20 


ID.end Time interview ended 
16:42:44 


ID. Duration of interview 
time 7.35 


new Case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
C) Yes 

© No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Yes, but it is not an “easy read” the answers are contained in many sections. A flow chart of the process 
may help, as would an index or FAQ. 


Q2 


Does the draft guidance contain the right level of detail? 
O) Yes 
© No 
©) Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Yes, but it would be more helpful to include examples of what is included in the response to a SAR and 
also to what extent should the subject have access to confidential information eg such as safeguarding, 


which in their possession could cause harm to another but is not quite covered by an education 
exemption. 


Q3 


Does the draft guidance contain enough examples? 
O) Yes 
© No 
©) Unsure / don't know 


If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


No, we struggle to find the answers concisely to what data should be given as part of a request. Your 
draft guidance covers unstructured manual records and pupils’ educational records but does not include 
whether data supplied by the subject is included, such as emails that have responses etc which would be 
included. We have been using a combination of resources including the ICO “Access to Information held 
in complaint files” documentation to navigate our way through these types of SARs. 


Q4 


Q5 


We have found that data protection professionals often struggle with applying and defining ‘manifestly 
unfounded or excessive’ subject access requests. We would like to include a wide range of examples 


from a variety of sectors to help you. Please provide some examples of manifestly unfounded and 
excessive 


requests below (if applicable). 


Repeated requests for the same information which was either excluded or redacted under an 
exemption. Some schools have been inundated by unrestricted requests, received multiple times (eg 
“I want everything you have”). The time spent collating, checking and then redacting other pupils 
names makes this very onerous, as is the cost. In most cases there is known pre-existing issue such 
as a decision has not gone the way of the parent and they think that by exercising this right (under 
Article 15) they can obtain access to data not previously available (eg on another child). Whilst the 
parent has a right to access this makes it difficult to contain the request to a ‘reasonable’ amount of 
data, in most of these cases the whole episode is distressing for the child. Interestingly most of these 
requests have been received by primary schools rather than secondary schools. We have only 


experienced such requests since May 2018. I would be happy to discuss this further and provide 
specific examples. 


On a scale of 1-5 how useful is the draft guidance? 


1-Notatall 2-Slightly Moderately 4-—Very 5-Extremely 
useful useful useful useful useful 


O O O © O 


Q6 Why have you given this score? 


We welcome the updated guidance which builds on the old guidance related to the 
DPA 1998 and links the articles and recitals of the GDPR with the extension to cover 


unstructured records in the DPA 2018. I think a flow chart and more example, or a 
link to a bank of sector specific examples would help. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree 


Agree agree 


© 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


A flow chart (or similar diagram) may make it easier to navigate, as would an index 
and a FAQ type section. Is it possible to provide an additional guide just for schools? 
There seem to be many complex elements for schools to cope with and a large 
amount of data provided in response to a SAR, one particular question is how and 
what to share regarding safeguarding information that is not covered by an 
exemption and what constitutes manifestly unfounded or excessive when related to 


school data following a complain about a complex issue. We would be happy for you 
to contact us to discuss this further. 


Are you answering as: 


C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 

© On behalf of an organisation 

€ ) Other 

Please specify the name of your organisation: 

Integra, the trading arm of South Gloucestershire Council 
What sector are you from: 

Education 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(|) ICO Facebook account 
©) ICO LinkedIn account 
© ICO website 
©) ICO newsletter 
C) ICO staff member 
C) Colleague 
©) Personal/work Twitter account 
(`) Personal/work Facebook account 
() Personal/work LinkedIn account 
O Other 
If other please specify: 


